Alert immediately at the first sign.
Suspicious access, unusual logins, or file tampering trigger a notice; this is checked by both manual and automated checks.
If caught this quickly, the damage does not spread; in Bangladesh, this process doesn't stop even on slow networks.
